AWS Landscape 12: Firewall

Deploying Palo Alto Virtual Firewalls ensures robust security for SAP workloads in AWS. This design enforces north-south traffic control (internet/on-prem) and east-west traffic inspection (VPC-to-VPC), while providing high availability (HA) and centralized monitoring.

Key benefits:

• Inspection of all inbound, outbound, and inter-VPC traffic.
• HA deployment across multiple AZs to prevent downtime.
• Centralized logging and management for compliance.

Objective:
Deploy Palo Alto Virtual Firewalls to:

• Enforce east-west (VPC-to-VPC via TGW) and north-south (Internet/On-Prem) traffic control.
• Ensure HA and fault-tolerant traffic flow.
• Enable centralized monitoring and logging.

Design Overview:

Technical Implementation Steps

Step 1: Launch VM-Series Instances

EC2 Console → Launch Instance → Community AMIs → Search "Palo Alto VM-Series".

Deploy 2 instances (HA pair):

Parameter             Value

Instance Type c5n.large (min) or m5n.xlarge

Subnet         Public subnet (1 per AZ)

EIP         Assign to Active FW

Security Group SSH(22), HTTPS(443) mgmt only

CLI: aws ec2 run-instances --image-id ami-xxxx --instance-type c5n.large --subnet-id subnet-public-az1 --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=PaloAlto-FW1}]'.

Step 2: Configure Network Interfaces

For each firewall instance (3 interfaces minimum):

eth0: Management (public subnet) → Palo Alto mgmt IP

eth1: Outside (untrust) → IGW/TGW

eth2: Inside (trust) → Private subnets

CLI (post-launch): aws ec2 assign-private-ip-addresses --network-interface-id eni-xxx --private-ip-addresses 10.0.1.10.

Step 3: Firewall Policy Configuration

North-South Rules:

1. Outbound: Allow SAP → HTTPS(443), HTTP(80), SAP Ports(3200-3299, 50000-59999)

2. Inbound: Allow Admin(443), SAP Router → Specific SAP ports only

3. Default: Deny All

East-West Rules (VPC→VPC via TGW):

1. Prod→Dev: Allow SAP app ports (3300-3399, 50000+)

2. All→Security: Allow logging (CloudTrail/Security Hub)

3. Default: Deny cross-environment unless explicitly allowed

Step 4: High Availability Setup

Palo Alto WebUI → Network → Interfaces → HA Interface (dedicated or spare).

Configure Active-Passive:

Setting       Primary (AZ1) Secondary (AZ2)

Group ID 1        1

Priority 100 (Active) 200 (Passive)

EIP         Primary  Failover target

Test: Power off Active → Passive takes EIP (~30s).

Step 5: Transit Gateway Integration

VPC Route Tables (Private subnets):

10.1.0.0/16 (Dev VPC) → eni-firewall-inside (not direct TGW)

Firewall Outside Interface → TGW attachment.

Traffic flow: SAP Prod → Firewall → TGW → SAP Dev (inspection enforced).

Step 6: Logging & Monitoring

Panorama (optional): Central management across accounts.

CloudWatch: Forward syslogs via rsyslog.

SIEM: S3 → Firehose → Security Lake.

CLI: aws logs create-log-group --log-group-name PaloAlto-ThreatLogs.

Traffic Flow Diagram

Route Table Example (Prod VPC Private Subnet)

10.0.0.0/16 → local (intra-VPC)

10.1.0.0/16 → eni-0a1b2c3d-firewall (Dev VPC via FW)

10.2.0.0/16 → eni-0a1b2c3d-firewall (QA VPC via FW)

0.0.0.0/0   → nat-gateway (outbound via FW)

Best Practices

Licensing: BYOL or PAYG via AWS Marketplace.

Auto Scaling: Use AWS Gateway Load Balancer (GWLB) for scale-out.

SAP Specific: App/VGUI ports (3200-3299), HANA (30015, 30017).

Cost: ~$0.50/hr per c5n.large + data processing.

Monitoring: Threat Prevention, URL Filtering, WildFire licenses.

Advanced: Deploy via AWS Gateway Load Balancer for horizontal scaling beyond HA pair.